@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/profiles/deployment-and-change-management/valid/infrastructure-apply.json

@@ -0,0 +1,78 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-1009-7a3b-8c4d-5e6f70819209",
+  "time": "2026-03-17T04:05:36.229Z",
+  "event": {
+    "name": "deployment.infrastructure.apply",
+    "category": "deployment",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Declared infrastructure state applied to the production cluster."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-infrastructure-reconciler"
+  },
+  "subject": {
+    "type": "user",
+    "id": "user-5061"
+  },
+  "delegation": {
+    "type": "on-behalf-of",
+    "reason": "The reconciler applied the declared state authored by the subject.",
+    "reference": "change-2026-0317-1"
+  },
+  "resource": {
+    "type": "infrastructure-plan",
+    "id": "infrastructure-plan-2026-0317-1",
+    "name": "checkout-platform-topology",
+    "parentId": "cluster-production-1"
+  },
+  "relatedResources": [
+    { "type": "cluster", "id": "cluster-production-1" },
+    { "type": "load-balancer", "id": "load-balancer-edge-2" }
+  ],
+  "application": {
+    "name": "infrastructure-controller",
+    "environment": "production",
+    "version": "3.8.1",
+    "region": "region-1",
+    "zone": "zone-a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "infrastructure-apply",
+    "policyVersion": "5"
+  },
+  "request": {
+    "requestId": "request-a70cd3",
+    "correlationId": "infrastructure-2026-0317-1"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["replicaCount", "loadBalancerIdleTimeoutSeconds"],
+    "before": { "replicaCount": 8, "loadBalancerIdleTimeoutSeconds": 60 },
+    "after": { "replicaCount": 12, "loadBalancerIdleTimeoutSeconds": 120 },
+    "ticketId": "change-2026-0317-1",
+    "deploymentId": "infrastructure-2026-0317-1"
+  },
+  "reason": {
+    "code": "capacity-increase",
+    "text": "Capacity raised ahead of the forecast seasonal peak.",
+    "reference": "change-2026-0317-1"
+  },
+  "controlCategories": ["change-management", "configuration-integrity"],
+  "tags": ["production"],
+  "metadata": {
+    "deployment": {
+      "id": "infrastructure-2026-0317-1",
+      "environment": "production",
+      "version": "topology-2026-0317-1",
+      "previousVersion": "topology-2026-0219-3",
+      "approvalRequired": false,
+      "pipelineId": "pipeline-infrastructure-reconcile"
+    }
+  }
+}

package/examples/profiles/deployment-and-change-management/valid/release-approve.json

@@ -0,0 +1,77 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-1004-7a3b-8c4d-5e6f70819204",
+  "time": "2026-03-16T14:22:10.642Z",
+  "event": {
+    "name": "deployment.release.approve",
+    "category": "deployment",
+    "type": "approve",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Release approved for deployment into the production environment."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-7702",
+    "roles": ["service-owner"]
+  },
+  "resource": {
+    "type": "release",
+    "id": "release-checkout-9-1-0",
+    "name": "checkout-service-release"
+  },
+  "relatedResources": [{ "type": "service", "id": "service-checkout" }],
+  "application": {
+    "name": "delivery-platform",
+    "environment": "production",
+    "version": "4.2.0",
+    "component": "approval-gate"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "production-release",
+    "policyVersion": "7"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-production-release",
+    "requestId": "approval-request-4471",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      { "type": "user", "id": "user-1180", "roles": ["change-manager"] },
+      { "type": "user", "id": "user-7702", "roles": ["service-owner"] }
+    ],
+    "approvedAt": "2026-03-16T14:22:10Z"
+  },
+  "request": {
+    "requestId": "request-77b0d2",
+    "correlationId": "deployment-2026-0316-9"
+  },
+  "change": {
+    "type": "none",
+    "ticketId": "change-2026-0316-9",
+    "deploymentId": "deployment-2026-0316-9"
+  },
+  "reason": {
+    "code": "planned-release",
+    "text": "Second approval recorded for the scheduled checkout release.",
+    "reference": "change-2026-0316-9"
+  },
+  "controlCategories": ["change-approval"],
+  "tags": ["production"],
+  "metadata": {
+    "deployment": {
+      "id": "deployment-2026-0316-9",
+      "environment": "production",
+      "version": "9.1.0",
+      "approvalRequired": true,
+      "pipelineId": "pipeline-checkout-delivery"
+    }
+  }
+}

package/examples/profiles/deployment-and-change-management/valid/release-cancel.json

@@ -0,0 +1,65 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-1007-7a3b-8c4d-5e6f70819207",
+  "time": "2026-03-16T11:12:48.550Z",
+  "event": {
+    "name": "deployment.release.cancel",
+    "category": "deployment",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Rollout halted by the on-call engineer before the remaining instances were replaced."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-8814",
+    "roles": ["on-call-engineer"]
+  },
+  "resource": {
+    "type": "deployment",
+    "id": "deployment-2026-0316-6",
+    "name": "checkout-service-release",
+    "parentId": "cluster-staging-1"
+  },
+  "relatedResources": [{ "type": "service", "id": "service-checkout" }],
+  "application": {
+    "name": "delivery-platform",
+    "environment": "production",
+    "version": "4.2.0",
+    "component": "release-controller"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "rollout-control",
+    "policyVersion": "3"
+  },
+  "approval": {
+    "status": "not-required"
+  },
+  "request": {
+    "requestId": "request-4d8e05",
+    "correlationId": "deployment-2026-0316-6"
+  },
+  "change": {
+    "type": "none",
+    "ticketId": "change-2026-0316-6",
+    "deploymentId": "deployment-2026-0316-6"
+  },
+  "reason": {
+    "code": "error-rate-regression",
+    "text": "Checkout error rate rose on the updated instances during the canary window."
+  },
+  "controlCategories": ["change-management"],
+  "tags": ["staging"],
+  "metadata": {
+    "deployment": {
+      "id": "deployment-2026-0316-6",
+      "environment": "staging",
+      "version": "9.1.2",
+      "approvalRequired": false,
+      "pipelineId": "pipeline-checkout-delivery",
+      "resultingState": "partially-applied"
+    }
+  }
+}

package/examples/profiles/deployment-and-change-management/valid/release-create.json

@@ -0,0 +1,53 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-1003-7a3b-8c4d-5e6f70819203",
+  "time": "2026-03-16T08:02:44.117Z",
+  "event": {
+    "name": "deployment.release.create",
+    "category": "deployment",
+    "type": "create",
+    "outcome": "success",
+    "severity": "low",
+    "summary": "Release candidate prepared from the merged change set."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-build-controller"
+  },
+  "resource": {
+    "type": "release",
+    "id": "release-checkout-9-1-0",
+    "name": "checkout-service-release"
+  },
+  "relatedResources": [{ "type": "service", "id": "service-checkout" }],
+  "application": {
+    "name": "delivery-platform",
+    "environment": "production",
+    "version": "4.2.0",
+    "component": "build-controller"
+  },
+  "request": {
+    "requestId": "request-51ac0e",
+    "correlationId": "deployment-2026-0316-4"
+  },
+  "change": {
+    "type": "create",
+    "changedFields": ["releaseVersion"],
+    "deploymentId": "deployment-2026-0316-4"
+  },
+  "reason": {
+    "code": "scheduled-release",
+    "text": "Release candidate built from the change set merged for this cycle."
+  },
+  "controlCategories": ["change-management"],
+  "metadata": {
+    "deployment": {
+      "id": "deployment-2026-0316-4",
+      "environment": "staging",
+      "version": "9.1.0",
+      "approvalRequired": false,
+      "pipelineId": "pipeline-checkout-delivery",
+      "artifactCount": 3
+    }
+  }
+}

package/examples/profiles/deployment-and-change-management/valid/rollback-emergency.json

@@ -0,0 +1,80 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-1008-7a3b-8c4d-5e6f70819208",
+  "time": "2026-03-16T23:48:12.071Z",
+  "event": {
+    "name": "deployment.release.rollback",
+    "category": "deployment",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Production reverted to the previous release during a customer facing outage."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-8814",
+    "roles": ["on-call-engineer"]
+  },
+  "resource": {
+    "type": "deployment",
+    "id": "deployment-2026-0316-11",
+    "name": "checkout-service-release",
+    "parentId": "cluster-production-1"
+  },
+  "relatedResources": [{ "type": "service", "id": "service-checkout" }],
+  "application": {
+    "name": "delivery-platform",
+    "environment": "production",
+    "version": "4.2.0",
+    "component": "release-controller"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "break-glass-rollback",
+    "policyVersion": "2",
+    "reason": "Actor holds the on-call role for the affected service."
+  },
+  "approval": {
+    "status": "pending",
+    "workflowId": "workflow-emergency-change",
+    "requestId": "approval-request-4488",
+    "requiredApprovals": 1,
+    "receivedApprovals": 0
+  },
+  "request": {
+    "requestId": "request-b03f19",
+    "correlationId": "deployment-2026-0316-11"
+  },
+  "change": {
+    "type": "restore",
+    "changedFields": ["releaseVersion"],
+    "ticketId": "change-2026-0316-11",
+    "incidentId": "incident-2026-0316-2",
+    "deploymentId": "deployment-2026-0316-11"
+  },
+  "reason": {
+    "code": "service-outage",
+    "text": "Checkout failed for all customers after the release; the previous version was restored.",
+    "reference": "incident-2026-0316-2"
+  },
+  "controlCategories": ["change-management", "privileged-access"],
+  "tags": ["production", "emergency-change"],
+  "metadata": {
+    "deployment": {
+      "id": "deployment-2026-0316-11",
+      "environment": "production",
+      "version": "9.0.3",
+      "previousVersion": "9.1.0",
+      "approvalRequired": true,
+      "emergency": true,
+      "pipelineId": "pipeline-checkout-delivery",
+      "resultingState": "rolled-back"
+    }
+  }
+}

package/examples/profiles/deployment-and-change-management/valid/secret-rotate-emergency.json

@@ -0,0 +1,73 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-100b-7a3b-8c4d-5e6f7081920b",
+  "time": "2026-03-18T02:19:41.006Z",
+  "event": {
+    "name": "configuration.secret.rotate",
+    "category": "configuration",
+    "type": "rotate",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Message broker credential replaced after a suspected exposure."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0247",
+    "roles": ["security-responder"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-broker-credential",
+    "name": "broker-service-credential",
+    "parentId": "cluster-production-1",
+    "classification": "restricted"
+  },
+  "relatedResources": [{ "type": "service", "id": "service-order-router" }],
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "version": "9.0.3"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "break-glass-secret-rotation",
+    "policyVersion": "4"
+  },
+  "approval": {
+    "status": "not-required"
+  },
+  "request": {
+    "requestId": "request-e12b47",
+    "correlationId": "incident-2026-0318-1"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["secret"],
+    "ticketId": "change-2026-0318-2",
+    "incidentId": "incident-2026-0318-1"
+  },
+  "reason": {
+    "code": "suspected-credential-exposure",
+    "text": "Credential rotated immediately after it was found in an unprotected build artifact.",
+    "reference": "incident-2026-0318-1"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "tags": ["production", "emergency-change"],
+  "metadata": {
+    "deployment": {
+      "id": "change-2026-0318-2",
+      "environment": "production",
+      "approvalRequired": false,
+      "emergency": true,
+      "pipelineId": "pipeline-secret-rotation",
+      "secretType": "broker-credential",
+      "rotationIntervalDays": 30
+    }
+  }
+}

package/examples/profiles/document-management/README.md

@@ -0,0 +1,80 @@
+# Document management profile fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test the
+[document-management profile](../../../profiles/document-management/). The rules themselves are in
+[profile.json](../../../profiles/document-management/profile.json).
+
+```bash
+auditmodel check-profile examples/profiles/document-management/valid --profile document-management
+```
+
+Every fixture here — valid, invalid and not-applicable alike — is a **core-conforming** event. The
+ones under `invalid/` fail the profile, not the core schema. That separation is the point: a profile
+adds requirements to events the core already accepts.
+
+## The guarantee these fixtures carry
+
+Each file under `valid/` must satisfy all three commands, and a test enforces it:
+
+```bash
+auditmodel validate      examples/profiles/document-management/valid
+auditmodel lint-privacy  examples/profiles/document-management/valid
+auditmodel check-profile examples/profiles/document-management/valid --profile document-management
+```
+
+A profile that accepted an event the core rejects would break the core invariant. A profile that
+accepted an event carrying a credential would be worse than no profile.
+
+## Valid fixtures
+
+| File                    | Event                       | Demonstrates                                            |
+| ----------------------- | --------------------------- | ------------------------------------------------------- |
+| `file-upload.json`      | `document.file.upload`      | The core requirements alone                             |
+| `file-download.json`    | `document.file.download`    | A governed read — download is in scope, view is not     |
+| `file-delete.json`      | `document.file.delete`      | Deletion with a justification and an approval           |
+| `share-internal.json`   | `document.share.create`     | An internal share, where no expiry is required          |
+| `share-external.json`   | `document.share.create`     | An external share: expiry and justification required    |
+| `share-revoke.json`     | `document.share.revoke`     | Withdrawal, which needs the recipient type but no grant |
+| `permission-grant.json` | `document.permission.grant` | An access-policy change naming its subject              |
+| `version-rollback.json` | `document.version.rollback` | A rollback naming the version it replaced               |
+| `retention-update.json` | `document.retention.update` | A retention transition recorded as before and after     |
+| `legal-hold-apply.json` | `document.legal-hold.apply` | A hold recording its resulting state                    |
+
+Three of these produce a `DOC-CORE-002` **warning** for a missing `/reason`. That is intentional:
+a routine upload or download often has no business justification beyond the user's job, and the
+profile recommends rather than requires one. A warning never fails conformance.
+
+## Invalid fixtures
+
+Each removes exactly one required field from a valid fixture, so it fails for one documented reason.
+A test asserts both the rule and the pointer, and that **exactly one** error is produced.
+
+| File                                     | Violates            | At                               |
+| ---------------------------------------- | ------------------- | -------------------------------- |
+| `upload-missing-authorization.json`      | `DOC-CORE-001`      | `/authorization`                 |
+| `download-missing-classification.json`   | `DOC-CORE-001`      | `/resource/classification`       |
+| `share-missing-recipient-type.json`      | `DOC-SHARE-001`     | `/metadata/share/recipientType`  |
+| `share-create-missing-permission.json`   | `DOC-SHARE-002`     | `/metadata/share/permission`     |
+| `external-share-missing-expiry.json`     | `DOC-SHARE-003`     | `/metadata/share/expiresAt`      |
+| `external-share-missing-reason.json`     | `DOC-SHARE-003`     | `/reason`                        |
+| `permission-grant-missing-grantee.json`  | `DOC-PERM-001`      | `/metadata/permission/granteeId` |
+| `version-rollback-missing-previous.json` | `DOC-VERSION-002`   | `/metadata/version/previousId`   |
+| `delete-missing-reason.json`             | `DOC-DELETE-001`    | `/reason`                        |
+| `retention-update-missing-class.json`    | `DOC-RETENTION-001` | `/metadata/retention/class`      |
+| `legal-hold-missing-state.json`          | `DOC-HOLD-001`      | `/metadata/legalHold/active`     |
+
+## Not-applicable fixture
+
+`file-view.json` is a `document.file.view` event. It is a perfectly good audit event that this
+profile deliberately does not govern, and `check-profile` reports it as not applicable with exit
+code 3.
+
+It exists to hold the exclusion in place. If a future edit widened a selector to a bare `document.`
+prefix, this fixture would start conforming instead of being skipped, and the test would fail — which
+is the point, because that edit would silently impose requirements on every view event in a document
+system.
+
+## Vendor neutrality
+
+No fixture names a real product, company, jurisdiction or regulation. Retention classes, hold
+references and policy names are illustrative strings, not any organization's scheme.

package/examples/profiles/document-management/invalid/delete-missing-reason.json

@@ -0,0 +1,53 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0003-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T13:22:03.100Z",
+  "event": {
+    "name": "document.file.delete",
+    "category": "data-modification",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Superseded contract draft deleted after migration."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f3",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  },
+  "approval": {
+    "status": "approved",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1
+  }
+}

package/examples/profiles/document-management/invalid/download-missing-classification.json

@@ -0,0 +1,46 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0002-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T12:22:02.100Z",
+  "event": {
+    "name": "document.file.download",
+    "category": "data-access",
+    "type": "read",
+    "outcome": "success",
+    "summary": "Contract document downloaded by an authorized reviewer."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f2",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  }
+}

package/examples/profiles/document-management/invalid/external-share-missing-expiry.json

@@ -0,0 +1,68 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0005-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T15:22:05.100Z",
+  "event": {
+    "name": "document.share.create",
+    "category": "data-access",
+    "type": "share",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Confidential document shared with an external recipient."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f5",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  },
+  "reason": {
+    "code": "customer-request",
+    "text": "Supplier requested the countersigned agreement.",
+    "reference": "support-case-3391"
+  },
+  "privacy": {
+    "containsPersonalData": true,
+    "dataCategories": ["identifier", "contact"],
+    "processing": "mask",
+    "minimized": true,
+    "purpose": "access-transparency"
+  },
+  "controlCategories": ["external-data-sharing"],
+  "metadata": {
+    "share": {
+      "recipientType": "external",
+      "permission": "view",
+      "watermarkApplied": true
+    }
+  }
+}